oss-sec mailing list archives
Re: CVS-Request: realmd code execution/auth bypass
From: Sebastian Krahmer <krahmer () suse de>
Date: Wed, 25 Mar 2015 14:16:48 +0100
CVE-Request indeed :D On Wed, Mar 25, 2015 at 01:54:38PM +0100, Sebastian Krahmer wrote:
Hi Upstream has opened two bugs for issues in realmd that could lead to remote attackers logging into the local system by placing an evil AD server in the LAN or by offering \r in LDAP responses that are treated by sssd and winbind as newline separator; therefore allowing to smuggle options into the config files used for startup: https://bugs.freedesktop.org/show_bug.cgi?id=89205 https://bugs.freedesktop.org/show_bug.cgi?id=89207 Sebastian -- ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer () suse de - SuSE Security Team
-- ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer () suse de - SuSE Security Team
Current thread:
- CVS-Request: realmd code execution/auth bypass Sebastian Krahmer (Mar 25)
- Re: CVS-Request: realmd code execution/auth bypass Sebastian Krahmer (Mar 25)
- Re: CVS-Request: realmd code execution/auth bypass cve-assign (Mar 25)
- Re: CVS-Request: realmd code execution/auth bypass Sebastian Krahmer (Mar 30)
- Re: CVS-Request: realmd code execution/auth bypass cve-assign (Mar 30)
- Re: CVS-Request: realmd code execution/auth bypass cve-assign (Mar 25)
- Re: CVS-Request: realmd code execution/auth bypass Sebastian Krahmer (Mar 25)